Analysis of Control Strategies for Aircraft 
Flight Upset Recovery 


Luis G. Crespo* 

National Institute of Aerospace 

Sean P. Kenny and David E. Cox^ 

Dynamic Systems and Control Branch, NASA Langley Research Center 

Daniel G. Murri* 

NASA Engineering and Safety Center, NASA Langley Research Center 


This paper proposes a framework for studying the ability of a control 
strategy, consisting of a control law and a command law, to recover an 
aircraft from flight conditions that may extend beyond the normal flight 
envelope. This study was carried out (i) by evaluating time responses of 
particular flight upsets, (ii) by evaluating local stability over an equilibrium 
manifold that included stall, and (iii) by bounding the set in the state space 
from where the vehicle can be safely flown to wings-level flight. These states 
comprise what will be called the safely recoverable flight envelope (SRFE), 
which is a set containing the aircraft states from where a control strategy 
can safely stabilize the aircraft. By safe recovery it is implied that the tran- 
sient response stays between prescribed limits before converging to a steady 
horizontal flight. The calculation of the SRFE bounds yields the worst-case 
initial state corresponding to each control strategy. This information is 
used to compare alternative recovery strategies, determine their strengths 
and limitations, and identify the most effective strategy. In regard to the 
control law, the authors developed feedback feedforward laws based on the 
gain scheduling of multivariable controllers. In regard to the command law, 
which is the mechanism governing the exogenous signals driving the feed- 
forward component of the controller, we developed laws with a feedback 
structure that combines local stability and transient response considera- 
tions. The upset recovery of the Generic Transport Model, a sub-scale 
twin-engine jet vehicle developed by NASA Langley Research Center, is 
used as a case study. 

Keywords: loss of control, flight control, upsets, homothetic deformations. 

* Associate Research Fellow, 100 Exploration Way, Hampton VA 23666 USA. A1AA Senior Member. 

t Senior Research Engineer, Mail Stop 308, NASA LaRC, Hampton VA 23681 USA. 

*NASA Technical Fellow, Mail Stop 308, NASA LaRC, Hampton VA 23681 USA. A1AA Senior Member. 

1 of 31 


American Institute of Aeronautics and Astronautics 



I. Introduction 


In-flight loss of control (LOG) was the largest fatal accident category for commercial jet 
airplane accidents worldwide in the last decade [1]. Aircraft LOG can be described as motion 
that is: outside the normal operating flight envelope; not predictably altered by pilot control 
inputs; driven by nonlinear effects and coupling; and characterized by disproportionately 
large responses to small changes in the vehicle’s state; or oscillatory /divergent behavior [1], 
The uncommanded angular rates and displacements characterizing these responses seriously 
compromise the ability to maintain heading, altitude, and wings-level flight. The primary 
drivers of LOG are entry into a vehicle upset condition, loss of control effectiveness, and 
severe degradations of the aircraft’s handling/ flying qualities. This paper studies the first of 
these three causes. 

Transport simulations and flight control systems have traditionally been developed for 
normal flying conditions. It is therefore vital to use enhanced transport simulation tech- 
nologies for evaluation of off-nominal conditions where the effects of nonlinear dynamics and 
uncertainties are dominant. Since the aircraft dynamics during upsets are dominated by 
strong nonlinearities, analyses based on linear time-invariant (LTI) models are of limited 
value. Unfortunately, most of the mathematical tools for control analysis are based on such 
models. 

This paper studies upset recovery by using a high fidelity aircraft model. A model of 
the Generic Transport Model (GTM), a subscale twin-engine jet vehicle developed by the 
National Aeronautics and Space Administration (NASA) Langley Research Center, is used 
as a case study. The closed-loop dynamics are given by a nonlinear dynamic model and 
a flight control system. This control system consists of (i) a longitudinal controller having 
the elevators deflection as control input, (ii) an auto-throttle having the throttle-input to 
both engines as control input, and (iii) a lateral/directional multivariable controller having 
the ailerons and rudders as inputs. These controllers, which assume a full-state feedback 
feedforward structure, comprise the control law. The feedforward component of the controller 
is driven by commands generated by the pilot. These commands, which are exogenous 
signals to the system, are created by the pilot based on the current aircraft’s state and the 
desired steady-state flight condition. This paper assumes that there is a feedback-based law, 
called the command law , governing the commands driving the feedforward component of 
the controller. Command laws based on local stability arguments, dynamic arguments for 
attitude and altitude stabilization, and piloted simulations are derived and analysed. 

The efficacy of a control strategy depends upon both the control and command laws. 
This paper derives a few control strategies, where a control law and a command law were 
paired, and explores their ability to safely recover the aircraft from flight upsets. Three 
analyses were applied to each control strategy. In the first analysis the authors evaluated 
the aircraft’s time response to seven flight upsets: nose-up, nose-down, inverted-flight, stall, 
deep-stall, spin, and high-sideslip. These simulations, which were set according to piloted 
simulations under realistic flight conditions, provided local figures of merit for the recovery. 
In the second analysis, the authors evaluated local stability about the equilibrium manifold 
corresponding to angles of attack varying from cruise to post stall conditions. This analysis 
yielded ranges of the angle of attack where the system become unstable. In the third analysis, 
the authors calculated inner bounds to the safely recoverable flight envelope (SRFE) and 
the corresponding worst-case flight conditions. Since the SRFE is a subset of the state space 
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from where the recovery is effective, its inner bound is a global figure of merit for upset 
recovery. 

The above analysis sequence was used to assess flight upset recoverability for various 
control strategies. This enabled the authors to (i) determine if the role played by the con- 
troller at the onset of the upset, where the vehicle state might be far away from the trim 
point used for control design, is beneficial; (ii) identify the strengths and limitations of the 
control strategy, (iii) determine which command law offers a superior upset recovery, and 
(iv) generate command laws that can be used for pilot queueing and automatic recoveries. 

This paper is organized as follows: section II presents details of the aircraft model and the 
controller’s architecture; this is followed by section III, where the background of the analysis 
tools mentioned above and their application to the GTM is summarized; these tools are 
applied to several control strategies in sections IV-VIII; the results are discussed in section 
IX; and finally, a few concluding remarks close the paper. 

II. Plant and Controller Architecture 

A. The Generic Transport Model 

The GTM is a model of a transport aircraft for which both a dynamically scaled flight test 
article and a high fidelity simulation were developed. Figure 1 shows the flight test article and 
its concept of operations. References [2, 3, 4] provide details on the vehicle’s configuration 
and characteristics and the flight experiments. The aircraft is piloted from a ground station 
via radio frequency links by using onboard cameras and synthetic vision technology. The 



Figure 1. NASA GTM test article and its concept of operations. 

high fidelity simulation uses nonlinear aerodynamic models extracted from wind tunnel data 
and system identification for conditions that include high angles of attack, and considers 
actuator dynamics with rate and range limits, engine dynamics, sensor dynamics along with 
analog-digital-analog latencies and quantization, sensor noise and biases, telemetry uplink 
and downlink time delays, turbulence, atmospheric conditions, etc. The open-loop system 
model has 278 state variables. 

During stall, which occurs between angles of attack of 12 and 14 degrees, the vehicle 
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experiences a drop in altitude and an uncommanded roll departure. These effects, which are 
captured by the aerodynamic model of the high fidelity simulation, mimic the behavior of 
the test article observed in the flight experiments. 

B. Control Design 

The system dynamics can be represented as 

X = F(X,U,p), (1) 

where F is a nonlinear function of the state vector X, the control input U, and the vector 
of uncertain parameters , p. The vector of uncertainties, p, may contain parameters that 
affect the vehicle dynamics such as aerodynamic coefficients, initial conditions, time-delays, 
CG coordinates, etc. For control design purposes, this nonlinear plant is linearized about a 
trim point (X* (p ) , U* (p ) ) satisfying F(X* ,U* ,p) = 0 for the force and moment equations. 
Deviations from the trim values A"* and U* are written as lower-case letters hereafter, e.g., 
X = X* + x p and U = U* + u. Linearization of Eq. (1) about the trim point leads to the 
system 


x p = ApXp + B p u + u(x p , u, /)), 


where 


„ OF 
p ~ dx 


X*(p), U*(p) 


R _ d JL 

p ~ du 


x*(p), U*(p) 


( 2 ) 

( 3 ) 


and v contains higher-order terms. In a sufficiently small neighbourhood of the trim point, 
the effect of the higher-order terms is negligible. The LTI representation of the plant, which 
results from dropping the higher-order terms from Eq. (2), is given by 


Xp = A p (p)xp + B p (p)(R s (u) + d) + B 2 r , (4) 

where A p and B p , the system and control input matrices, have unknown components that 
depend on p: d(t) is an exogenous disturbance; r(t) is the reference command generated by 
the pilot; R s (u ) is a saturation function that enforces range saturation limits in the control 
inputs, and B 2 is the command input matrix. The vector p takes on the value p when the 
aircraft flies under nominal operating conditions. 

The state, x p , consists of angle of attack, a; sideslip angle, j3] speed, V; roll rate, p; pitch 
rate, q ; yaw rate, r; longitude, x; latitude, y; altitude, z\ and the Euler angles, -0, 9 , and 
0. The control input u consists of the elevator deflection, 5 e ; the aileron deflection, 5 a ; the 
rudder deflection, 5 r \ and the throttle input to the engines, 5th- The reference command r 
consists of angle of attack-, sideslip-, speed- and roll rate-commands. These four commands, 
denoted hereafter as a cm d, /9 C md ? Kmd ? and p C md, respectively, are generated by the pilot to 
attain the desired flight maneuver. 

The flight controller consists of independent controllers for the longitudinal and the lat- 
eral/directional dynamics. While the longitudinal controller consists of an auto-throttle and 
a multiple- input-single-output controller for pitch, the lateral/directional controller assumes 
a multiple-input-multiple-output structure. The controllers operating the control surfaces 
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have a linear quadratic regulator structure with proportional and integral (LQR-PI) terms 
having integral error states for each of the components of the reference command r. Further- 
more, strategies for preventing integrator windup caused by input saturation were applied. 
A fixed control allocation matrix that correlates inputs of the same class prescribes the 10 
main plant inputs: 4 elevators, 2 ailerons, 2 rudders and 2 throttles. As a result, out of these 
10 inputs only 4 are independent. 


1. Auto-throttle 


The throttle input to the engines was prescribed by a simple proportional-derivative con- 
troller with the form 

hth = Kiev + K 2 e y , (5) 


where 


e y — V — Kmd- (6) 

The regulation of airspeed and pitch control were done separately because of a large time 
scale separation between the corresponding actuators. In a previous work [5], a multivariable 
controller for both airspeed and pitch was developed. 


2. Longitudinal Controller 

The linearized plant for pitch control takes the form 


Aon - bon -Cl 0 n T B\ on U\ on , (7) 

where Ai on G M 3x3 is the system matrix, £>i on G M 3xl is the input matrix, xi on = [a q V] T is 
the state, and wi on = d e is the input. To enable tracking commands in angle of attack, the 
integral error state 


C a J (a ^cmd )^5 

was added. This led to the augmented plant 

% Ion 


•^lon 


Alon 

0 



Hi 

0 


+ 


-^lon 

0 


5 e + 


0 

-1 


C^cmcb 


where Hi = [1,0,0]. A constant gain LQR controller that minimizes 


J / {%\ on Q%\on H - S e R)dt, 
Jo 


where Q — Q T > 0, R > 0 are weighting matrices, was designed. This led to 


4 = 

-^lon J^ea 


^ Ion 


L J 




( 8 ) 


( 9 ) 


( 10 ) 


( 11 ) 
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This controller must attain ample stability margins so the low-pass- and anti- aliasing-filters 
from sensors and the delay caused by telemetry do not compromise stability. In particular, 
all controllers designed herein attained more than 6 dB of gain margin and 60 deg of phase 
margin. 

The plant’s input is given by 


R s (u) 


u 

if tlj nin < 'll < Umax, 


U'max 

if tl A tl maxi 

(12) 

'U' min 

otherwise, 



where u is the controller’s output, and u max and u min are the saturation limits of the actuator. 
The control deficiency caused by this saturation function is given by 


= R s (u) — u. (13) 

The integrator anti-windup strategy proposed in [5] was applied to the ( e a , S e ) pair. The 
aim of anti-windup compensation is to modify the dynamics of a control loop during con- 
trol saturation so that an improved transient behavior is attained after desaturation. This 
practice mitigates the chance of having limit cycle oscillations and successive saturation. 
Because there is a high chance of control input saturation during the upset recovery, the 
proper management of integrators is of paramount importance. 


3. Lateral/Directional Controller 

An LTI model of the corresponding plant is 

•i'la.t - T A] a |/i] a ) , (14) 

where Ai at G M 3x3 is the system matrix, B\ at G M 3x2 is the input matrix, x\ at = [f3 p r] T is the 
state, and u\ at = [<5 a <5 r ] T is the input. To enable satisfactory command following, integral 
error states for sideslip and roll rate, given by 


&/3 J (/^ Pcmd)dt^ 

e p= [(P- Pcmd)dt, 


(15) 

(16) 


were added. The integral error in sideslip was chosen over that of the yaw rate to facilitate 
the generation of commands for coordinated turns with non-zero bank angles and cross-wind 
landing. The augmented plant is given by 


•tlat 


Aat 

0 

H 2 

0 


*£lat 


e P 


+ 


B \ at 
0 


Wlat + 


0 


)i(:rri(l 

Pcmd 


(17) 


where H -2 = [[1,0] T [0, 1] T [0, 0] T ] . A LQR control structure for the lateral controller was 
adopted. This led to 


5a’ 

r 

1 

1 

- 


Alat A' ; Re 


^lat 

Cp 


( 18 ) 
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As before, this controller attains ample stability margins to accommodate for filters and time 
delays. The anti-windup technique in [5] was applied to the (e^, 5 r ) and (e p , S a ) pairs. 

4- Control Allocation 

Equations (11) and (18) along with the three realizations of the anti-windup technique 
mentioned above, prescribe the preallocated input u n = [5 e S a 5 r S t h} T , where 

U n K n [x\ on ^ a & V ^ V *^lat C /3 Cp] , (19) 

and K n G M 4x11 is the feedback gain. This input, along with a control allocation scheme, 
fully determines the 10 control inputs of the aircraft. This relationship can be written as 

^nom I 1 ' nom 0 n . (20) 

where G nom G M 10x4 is the control allocation matrix. The allocation of u n enforced by G nom 
makes the four elevators deflect the same, both ailerons deflect in opposite directions, the 
thrust of both engines equal, and the deflection of both rudders equal. 

C. Competing Control Alternatives 

This section presents details of the development and configuration of three flight control 
systems. Each of these systems will constitute one of the control strategies to be evaluated. 

Figure 2 shows projections of the equilibrium manifold corresponding to the open-loop 
plant for wings-level horizontal flight with angles of attack varying between 2 and 30 degrees 3 ". 
Trim points that are locally stable are colored in green while those that are locally unstable 
are shown in red. Note that the longitudinal dynamics are unstable in the [11.9,12.8] deg 
range while the lateral/directional dynamics are unstable in the [10.4, 14.25] and [23.85, 28.4] 
deg ranges. The corresponding locus of open-loop poles are shown in Figure 3, where the 
lateral poles are shown in blue and the longitudinal ones are in red. The large variation in 
the location of the poles indicates that the aircraft pre-stall, stall, and post-stall dynamics 
vary significantly. 

A single-trim-point flight controller for A"* and U* corresponding to horizontal, wings- 
level flight with a zero path-angle, and 80 knots was designed first. This controller consists of 
the auto-throttle, the longitudinal and the lateral/directional controllers introduced above. 
This controller will be denoted as C\ . The controller gains were tuned according to classical 
control metrics, which included stability margins, shaping of the input- and output-loop 
transfer-functions, and time responses to representative pilot commands. The control objec- 
tive was to obtain a controller that provides satisfactory pilot command tracking given the 
intrinsic time delays of the system. 

Figure 4 shows the states and commands corresponding to a typical maneuver within the 
normal flight envelope. The aircraft starts off from the trim point used for control design 
and then it is subjected to commands in angle of attack, side-slip, and roll rate. It can be 
seen that the controller tracked the doublets well while reaching the commanded airspeed 
after a short transient without significant changes in altitude. Figure 5 shows the same 

a The equilibrium manifolds displayed in this manuscript are based on the family of LTI models of the 
plant corresponding to varying values of angle of attack and, when applicable, to the corresponding linear 
controllers. Since the parameterizing variable of the gain scheduled controller is a state, the linearization of 
the corresponding nonlinear closed-loop system may yield LTI models that differ from the ones used herein. 
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Figure 2. Projections of the equilibrium manifold for varying levels of angle of attack. Points 
in green are locally stable while those in red are locally unstable. 


maneuver but for a sequence of commands centered about a trimmed point with a higher 
angle of attack. A substantial degradation in tracking performance occurred because this 
flight condition is far from A"*. Note that uncommanded oscillations in pitch appeared and 
the aircraft became unstable in both roll and yaw. 

Figure 6 shows the closed- loop poles corresponding to C\ . Note that even though this 
controller attains good command tracking in the normal flight envelope, it fails to locally 
stabilize the aircraft over the entire equilibrium manifold. Providing there is enough control 
authority, the aircraft might be kept near a locally unstable equilibrium point by a judicious 
and persistent set of commands f. 

To improve the command tracking performance outside the normal flight envelope, two 
gain-scheduled controllers were designed [6]. In regard to tracking performance the first 
controller, to be denoted as C 2 , can be regarded as aggressive; while the second controller, to 
be denoted as C 3, can be regarded as moderately aggressive. These controllers schedule three 
fixed-point controllers on the longitudinal and lateral axes with angle of attack. Since the 
scheduling variable is a state, the resulting controllers are quasi-linear parameter varying. 
The trim points used for control design correspond to angles of attack of 4.2, 13, and 22 
degrees. These values correspond to cruise, stall, and post-stall flight conditions, respectively. 
Each of the fixed-point controllers comprising the gain scheduled controller attains good 
tracking performance near the corresponding linearization point. Furthermore, they make 
the equilibrium manifold shown above locally stable at each point in the [2, 30] angle of 
attack degree range. The controller designed for 4.2 degrees used by both gain scheduled 
controllers is the very same C±. 
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Figure 3. Locus of the open-loop poles for varying values of angle of attack at trim in the [2, 30] 
degree range. Longitudinal poles are shown in red while the lateral/directional are shown in 
blue. 


Controller C 2 provides improved tracking command near stall at the expense of a reduced 
time delay margin in the lateral/directional axes. Figure 7 shows the corresponding closed- 
loop poles in the range of interest. As intended, this controller makes all the equilibrium 
points locally stable. The time responses corresponding to the same pilot commands of 
Figure 5 are shown in Figure 8 . I 11 contrast to the fixed-point controller, C\\ the gain- 
scheduled controller, C 2 ; attains good command tracking in all axes. A similar tracking 
performance was observed throughout the [2, 28] degree range of angle of attack. For larger 
angles of attack, good V command tracking is not possible due to the reduced control 
authority resulting from a saturated throttle input. 

Controller C 3 exhibits a degraded command tracking and larger time delay margins when 
compared to C 2 but still offers satisfactory command tracking in all axes. Figures with the 
corresponding locus of its closed-loop poles and the time response to commands outside the 
normal flight envelop are omitted. 

D. Command Law 

The commands r used in figures 4 and 5 were prescribed a priori based on standard flight 
maneuvers. In practice, however, they are generated by the pilot according to the existing 
flight condition and the desired aircraft state. Recall that the pilot commands are exogenous 
signals entering the controller via the feedforward terms defined by the integral error states 

e a , ey, &/ 3 , and e p . 
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Figure 4. Aircraft states and commands corresponding to maneuvers within the standard 
flight envelope for C\. 
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Figure 5. Aircraft states and commands corresponding to maneuvers outside the standard 
flight envelope for C\. 
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Figure 6. Locus of the closed-loop poles of C\ for varying values of angle of attack in the [2,30] 
degrees range. Longitudinal poles are shown in red while the lateral/directional are shown in 
blue. 


This paper investigates command laws assuming a feedback structure where f is a func- 
tion of the current and the targeted aircraft states, i.e., r(X(t), Warget)- These command 
laws are vehicle and control-law dependent and will only address the need for reaching the 
target state X target from arbitrary initial conditions. This structure enables the generation 
of command laws that change at the same time scale as the aircraft’s state. Furthermore, 
these command laws are easy to implement, for example, to execute an automated upset 
recovery; while enabling the application of control analysis tools. There are many command 
laws, having a feedback structure or not, that would perform satisfactorily. It is of interest 
to determine if the actions taken by a pilot under realistic conditions can be effectively and 
accurately represented by a feedback structure, what the functional form of that structure 
would be, and what the features characterizing effective command laws would be. While 
these issues motivate some of the developments in this paper, they are out of the scope of 
this work. 

Given the control architecture above, we adopted command laws with the form 


^cmd ^target “ 1 “ target)? 

( 21 ) 

/^cmd /^target H“ f (3 (-^5 -^-target ) 5 

( 22 ) 

Kmd ^target “ 1 “ target ) 5 

(23) 

Pcmd Ptarget -^target)} 

(24) 


where / = [,/ Q , fp , fv , f P ] T is comprised of functions that approach zero when X approaches 
Xtarget- For a stabilizing controller, i.e., a controller that drives a, /3, V, and p from an initial 
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Figure 7. Locus of the closed-loop poles of for varying values of angle of attack in the [2,30] 
degrees range. Longitudinal poles are shown in red while the lateral/directional are shown in 
blue. 



Figure 8. States and commands corresponding to maneuvers outside the normal flight envelope 
for C 2 . 
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state to a cm d, Amd, K.md, and p cm d, the above functional forms ensure that the commands 
will approach the target state, thus, that the aircraft state will approach the target state. 

In this study, the target state X targe t is given by a targe t = 4.28 deg, Vtarget = 80 knots, 

/^target Ptarget (/target ("target 0 degrees/ SeCOlld, and ^target ^target 0 degrees. 

This flight condition corresponds to a locally open-loop and closed-loop stable, zero path- 
angle, wings-level flight. The functional forms of the components of /, which are yet to 
be determined, are responsible for driving the states that are not commanded directly to 
their target values, e.g., for making the yaw rate, r, converge to zero by prescribing suitable 
transients for /3 cm( j and p cm d ■ Note that all the 7 variables 7 , /3, V, p , q , r, and </> must 
reach fixed target values by manipulating the 4 commands, a cm d, Amd, K.md, and p cm d-Thus, 
/ is responsible for driving the states, directly commanded or not, to the desired state. 
For instance, the command law a cm d = ^target — will drive the angle of attack from a 
suitable initial condition to its targeted value while reaching a zero path angle in steady 
state. Particular command laws are proposed below. 

III. Analysis Framework 

This section briefly introduces the framework used to evaluate control strategies for upset 
recovery. Two evaluations are carried out. In the first analysis the authors evaluate the time 
response of the closed-loop system to seven flight upsets. The aircraft states at which the 
upsets occur were generated using piloted simulations. This evaluation only provides a local 
notion of effectiveness. In the second analysis, the authors calculate inner bounding sets 
of the SRFE centered about X targe t. This evaluation provides a global notion of recovery 
effectiveness. 

A. Local Analysis: Point Simulations 

Piloted, real-time simulations were used to identify initial aircraft states leading to flight 
upsets. These upsets, which are characterized by the occurrence of uncommanded aircraft 
responses, are well outside the normal flight envelope. A brief description of each of them is 
given next. 

1) Nose-up: This condition is characterized by a post-stall angle of attack, low airspeed, 
and a large and positive path angle. The roll asymmetry present in the stall range, 
excites the lateral and directional dynamics during the recovery. 

2) Nose-down: This upset is characterized by a small angle of attack, a large airspeed, 
and a steep descent. During the recovery the aircraft reaches speeds outside the normal 
flight envelope. 

3) Inverted flight: This flight condition is characterized by a bank angle of 180 degrees 
and a steep descent. A successful recovery requires a large roll rate to bring the vehicle 
back to a non-inverted flight. The recovery can yield speeds outside the normal flight 
envelope. 

4) Stall: This upset is characterized by a large angle of attack, a negative path angle, 
and a low airspeed. The roll departure at stall preceding the upset creates moderate 
roll and yaw rates. 
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5) Deep stall: This is like the stall condition above, but it attains a larger angle of attack 
and steeper descent. 

6) Spin: This upset is characterized by a very large angle of attack, a low airspeed, a 
large and negative path angle, large pitch, roll, and yaw rates, and a moderate sideslip 
angle. During the recovery the aircraft experiences large airspeeds. 

7) High sideslip/roll rates: This condition is characterized by a large sideslip angle 
and large roll and yaw rates. The aerodynamics of the aircraft in this flight regime has 
a stabilizing effect. 

Several control strategies were evaluated by simulating these flight upsets. The corresponding 
time-responses will be qualified according to several figures of merit. These figures of merit, 
which take into account several stability and performance considerations, are introduced in 
the following section. 

B. Global Analysis: Homothetic Deformations 

To make this paper self-contained, a brief introduction to the control analysis methodology 
proposed in [7] is presented next. Consider the dynamic system in (1) and the control law 

U = U (A, r), (25) 

where U refers to a particular control structure, and f are the pilot commands feeding into 
the feedforward part of the controller. Assuming that the pilot commands have the feedback 
structure f (/(A), A targe t), the expression 

X = F (A, U (A, /(A), A target ), p) , (26) 

fully describes the closed-loop system response. 

In this paper p represents the aircraft state at which the recovery is initiated, i.e., p = 
A(0). In contrast, the analysis in [5] considered uncertain parameters representing actuator 
failures, unknown time-delays and unknown aerodynamic coefficients. The aircraft response 
to the commands r is deemed safe when a set of requirements is satisfied. These requirements 
are represented by a set of inequality constraints on selected output metrics. Specifically, 
satisfaction of the vector inequality 

g(P)< 0, (27) 

implies the satisfaction of all the requirements. These constraints partition the state space 
into two sets, the failure domain T = {p : gi(p) > 0 for some i\ where at least one require- 
ment is violated, and the safe domain S = {p : g,ip) < 0 for all i} where all requirements 
are satisfied. Note that S is the SRFE defined earlier. The term “safe recovery” , which is to 
be captured in g, is broad in scope and refers to acceptable ranges of variation in metrics of 
interest. These metrics may correspond to specific performance and stability specifications 
as well as to typical notions of goodness. 

Let p, called the nominal parameter point, be equal to A" target . The objective of this 
analysis is to determine the largest deviation from p for which all the requirements are met, 
i.e., the family of initial conditions centered about the target state from which the aircraft can 
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be safely stabilized. In this paper, such a deviation will be prescribed as a hyper-rectangular 
set of fixed proportions. The notions required to calculate this deviation are introduced next. 

A homothetic deformation results from a uniform, radial expansion or contraction of the 
space about a fixed point. The distance from any point in the space to the fixed point 
changes by a factor e after the deformation. This factor is called the similitude ratio of 
the deformation. Note that if e is greater than 1, the deformation is an expansion, while 
if e is less than 1, the deformation is a contraction. A hyper- rectangular reference set , 
denoted as C will be deformed with respect to its geometric center p. Intuitively, 

one can imagine that is being deformed homothetically with respect to p G S until the 
deformed set touches the failure domain boundary. This deformation will be called the 
Maximal Deformation. The set resulting from this deformation is the maximal set. A critical 
parameter value (CPV) is (one of) the point (s) where the maximal set touches T . In the 
context of this paper, the CPV is the worst-case initial state. The critical similitude ratio 
(CSR) is the similitude ratio of that deformation and is a nondimensional metric proportional 
to the separation between the point p and the failure domain. The parametric safety margin 
(PSM), p G M, is its dimensional equivalent. 

The values taken on by the CSR and the PSM are proportional to the size of the maximal 
set and measure the separation between p and F. The PSM is assigned a negative value 
if the control strategy does not even satisfy the requirements at p. If the PSM is zero, the 
control strategy exhibits no robustness because there is an arbitrarily small deviation from 
p leading to a requirement violation. If the PSM is positive, the requirements are satisfied 
at p and its vicinity. The larger the PSM, the larger the fl-shaped vicinity of p where the 
requirements are satisfied. The formulation used to calculate maximal deformation can be 
found in [5, 7]. 

The requirements used to prescribe a safe upset recovery for the GTM are as follows: 

1) Structural loading: the requirement g\ < 0 ensures that the loading factor caused by 
the vehicle’s acceleration does not exceed 2gs. This acceleration is below the loading 
limit for the fuselage. 

2) Admissible range of roll rate: the requirement g^ < 0 ensures that the absolute 
value of the roll rate does not exceed 200 deg/s throughout the recovery. 

3) Admissible range of pitch rate: the requirement g^ < 0 ensures that the absolute 
value of the pitch rate does not exceed 80 deg/s throughout the recovery. 

4) Admissible range of yaw rate: the requirement g± < 0 ensures that the absolute 
value of the yaw rate does not exceed 90 deg/s throughout the recovery. 

5) Admissible range of angle of attack: the requirement g 5 < 0 ensures that the 
angle of attack remains in the [—5, 50] deg range throughout the recovery. 

6) Admissible range of sideslip: the requirement g§ < 0 ensures that the sideslip angle 
stays in the [—30, 30] deg range throughout the recovery. 

7) Admissible range of airspeed: the requirement gj < 0 ensures that the true aero- 
dynamic speed stays in the [40, 200] knot range throughout the recovery. 
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8) Admissible altitude range: the requirement g$ < 0 ensures that the altitude stays 
in the [300, 1500] ft range throughout the recovery. This requirement prescribes the 
maximum loss in altitude that is acceptable. 

9) Translational stability: the requirement gg < 0 ensures that the magnitude of the 
translational acceleration is bounded by a small constant for the last 5 seconds of the 
simulation. 

10) Rotational stability: the requirement g 10 < 0 ensures that the magnitude of the 
rotational acceleration is bounded by a small constant for the last 5 seconds of the 
simulation. 

11) Orientation of the z-axis: the requirement gu < 0 ensures that the angle between 
the 2- axis in the body frame and the z axis in the flat-earth frame is less than 90 deg 
after a short transient. 

12) Stable steady-state: the requirement g 12 < 0 ensures that the aircraft state is within 
a small box centered about X target during the last 5 s of the simulation. 

13) High-frequency oscillations in pitch: the requirement g 13 < 0 ensures that the 
amount of power in pitch exceeding 5 Hz is bounded by a small constant. This, and 
the following two requirements, are violated when limit cycle oscillations occur. 

14) High-frequency oscillations in roll: the requirement g 14 < 0 ensures that the 
amount of power in roll exceeding 5 Hz is bounded by a small constant. 

15) High-frequency oscillations in yaw: the requirement r/15 < 0 ensures that the 
amount of power in yaw exceeding 5 Hz is bounded by a small constant. 

Note that the controller’s ability to satisfy the requirements depends on the aircraft’s tran- 
sient response, whose analytical representation is mathematically intractable due to nonlin- 
earities. Further notice that the dependency of g on p assumes an unknown and implicit 
functional form. Evaluating g for a particular realization of p requires simulating the closed- 
loop response for a fixed integration time and using the corresponding closed-loop signals to 
evaluate the 15 constraints. The functional form of the requirement functions, which relate 
the value of g with the aircraft state, are omitted from this paper. While the notions of 
recovery effectiveness supporting the requirement functions are fairly universal, their par- 
ticular functional form is not. It is up to the analyst to construct functions that properly 
describe his/her notion of acceptable/safe recovery. 

Because of the feedback structure of the command law, the SRFE is a subset of the 
domain of attraction of the equilibrium point X target of the dynamic system in (26) having 
a requirement-compliant transient response. 

In the following sections the authors apply the local and global analyses above to assess 
a few control strategies. The local analyses, which are based on the point simulations of 
section III-A, will be assessed using the same performance functions of the global analysis. 
However, the authors will consider the requirements g\ < 0, g$ < 0, gg < 0, g\g < 0, g \2 < 0 
mission-critical or ’’hard”, since they may indicate instability or loss of the mission 13 , while 

b While positive values of gs indicate an excessive loss in altitude, only those where gs > 2.28 indicate a 
crash. Therefore, the numerical value of gs determines if the violation is critical or not. 
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the other ones will be regarded as ’’soft”. This distinction allows the analyst to better qualify 
the efficacy and performance of the control strategy. 

The five control strategies evaluated next are: (i) fixed control surface deflections and 
fixed velocity command, (ii) fixed-gain controller C\ with fixed commands, (iii) fixed-gain 
controller C\ with a state-varying command law, (iv) an aggressive gain scheduled controller 
C 2 with a state-varying command law, and (v) a moderately aggressive gain scheduled con- 
troller C 3 with a state-varying command law. 

IV. Strategy 1: Fixed Control Surface Deflections &; Fixed V C md 

This control strategy uses the control surface deflections in U* corresponding to X* = 
^target for attitude control and a fixed-trimmcd point auto-throttle for speed regulation. 
Figure 2 indicates that the point A" tai . get , located at a = 4.2 degrees, is locally open-loop 
stable, so all aircraft states within the corresponding domain of attraction will converge to 
the target state. It remains to be determined if the domain of attraction is large enough to 
make this strategy useful. Because the corresponding time response will be driven by the 
uncontrolled modes, the resulting transient response may exhibit undesired characteristics. 
This is the rationale supporting the usage of the auto-throttle, which aims at regulating the 
phugoid mode of the longitudinal response. 

A. Strategy 1: Local Analysis via Point Simulations 

The constraint functions defined in section III-B were used to qualify the ability of this 
strategy to recover from the seven flight upsets described in section III-A. Table 1 shows the 
value of g corresponding to each upset. Recall that negative values indicate the satisfaction 
of a requirement while positive values indicate a violation. Also remember that requirements 
g i < 0, g 8 < 0, g 9 < 0, g w < 0, and g i2 < 0 are mission critical while the other ones are 
not, i.e., the aircraft can be stabilized when requirements other than these are violated. The 
rows corresponding to the hard requirements indicate that this strategy can overcome the 
nose-up, nose-down, and stall upsets but not the others. In regard to the nose-up upset, 
only the airspeed requirement is violated, while for both nose-down and stall conditions, all 
requirements are satisfied. While rotational equilibrium is achieved in all cases, the upsets 
for which the vehicle could not be recovered are characterized by extreme airspeeds and large 
losses in altitude. This can be seen in Figure 9, where the aircraft states corresponding to 
the spin condition are shown. The throttle input, which is not shown, saturates at 0% and 
100% a few times throughout the maneuver. 

B. Strategy 1: Global Analysis via SRFE Bounding 

The maximal deformation defined in section III-B corresponding to strategy 1 was calculated 
and the results are presented next. Note that the maximal set is a 8-dimensional hyper- 
rectangle in the state space centered at the target flight condition At arge t = [4.2,80,0,0,0, 
0,0,0], which corresponds to a horizontal flight at cruise speed. Recall that the maximal 
set, which is an inner bound to the SRFE whose size is proportional to the value of the 
PSM, touches the requirement violation point A worst _ case at its boundary. This point is the 
worst-case initial state for the particular upset recovery strategy. 
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Table 1. Figures of merit of upset recovery for strategy 1. 



Nose-up 

Nose-down 

Inverted 

Stall 

Deep Stall 

Spin 

High P 

Structural loading: gi 

-0.78 

- 0.86 

-0.64 

-0.80 

-0.67 

- 0.68 

-0.76 

Roll rate: <72 

-0.89 

-0.97 

- 0.66 

-0.91 

-0.65 

0.01 

- 0.01 

Pitch rate: g 3 

-0.73 

-0.76 

-0.61 

-0.76 

-0.62 

- 0.22 

-0.41 

Yaw rate: <74 

-0.75 

-0.96 

-0.35 

-0.80 

- 0.21 

-0.09 

-0.46 

Angle of attack: <75 

-0.32 

- 0.22 

-0.28 

-0.32 

-0.25 

-0.04 

- 0.11 

Sideslip angle: g§ 

- 0.88 

-0.99 

-0.24 

-0.94 

-0.33 

- 0.66 

-0.53 

Airspeed: <77 

0.05 

-0.13 

1.13 

- 0.21 

0.72 

0.74 

1.13 

Altitude: g s 

-0.06 

-0.42 

1.59 

- 0.11 

0.97 

1.04 

1.40 

Translation: gg 

- 0.68 

-0.97 

10.91 

- 0.88 

0.3 

0.41 

0.86 

Rotation: gio 

-0.99 

-0.99 

-0.96 

-0.99 

-0.99 

-0.99 

-0.99 

Orientation: gn 

-0.38 

-0.71 

0.28 

-0.52 

0.10 

0.04 

0.39 

Steady state: <712 

- 0.68 

-0.97 

2.47 

-0.91 

-0.13 

0.07 

0.09 

Pitch oscillations: <713 

-0.99 

-0.99 

-0.99 

-0.99 

-0.98 

-0.96 

-0.97 

Roll oscillations: <774 

-0.98 

-0.99 

-0.94 

-0.99 

-0.78 

-0.73 

-0.72 

Yaw oscillations: <715 

-0.99 

-0.99 

-0.99 

-0.99 

-0.93 

-0.97 

- 0.88 
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Figure 9. States corresponding to the spin upset for strategy 1. 
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The PSM and the CPV corresponding to the control strategy number 1 are 42.1 and 
df worst-case = [11.24, —7.61, 82.88, 25.41, 12.7, 12.7, —6.5, 22.8] respectively. The components 
of A" worst _ C ase, which have the same units of Atarget, are [a, /3, V,p, q, r, 9, (/)]. The critical 
requirement, which is the one taking the value of zero at the CPV(s), is the altitude loss 
requirement. Figure 10 shows the aircraft states corresponding to the worst-case initial 
condition associated with this control strategy. Recall that this condition results from a 
search in the continuum of the state space and may not be an upset, i.e., may not be 
produced by or yield an unconnnanded aircraft response. 

We have used a logarithmic scale for the time axis in order to better show the first few 
seconds of the simulation. The requirement violation, which occurs at the final integration 
time, t = 45s, is caused by a sluggish auto-throttle response to airspeed variations. 



Figure 10. States corresponding to the worst-case initial state for strategy 1. 


V. Strategy 2: Controller C\ with Constant Commands 

Here the authors consider the single-trimmed point controller C\ combined with the 
command law in Equations (21-24) for / = 0 . This combination guarantees that, given 
a suitable initial condition (i.e., one at which the LTI model used for control design is an 
accurate representation of the dynamics), a, (3, V, and p will converge to the commanded 
values, which, due to the command law in Eq. (21-24), are the very same targeted states. 
This control strategy cannot guarantee that the uncommanded states will converge to the 
desired values, e.g., the altitude may keep dropping while the yaw rate may not converge to 
zero. 
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A. Strategy 2: Local Analysis via Point Simulations 

Tabic 2 shows the constraint functions corresponding to this control strategy for the seven 
upsets. As before, this strategy was unable to recover the aircraft from the inverted, deep 
stall, spin and high-/? upsets. While the performance of this strategy was similar to that of 
strategy number 1 in most cases, the inverted condition is much worse. Note that the vehicle 
hits the ground since g$ = 3.63 > 2.28. Further notice that the values taken by the pitch 
and yaw rate constraint functions, as well as those describing high frequency oscillations, 
are larger. This should be expected since, in contrast to strategy 1, the control surface 
deflections now vary with time. Figures 11 and 12 show the states, control inputs, and 

Table 2 . Figures of merit of upset recovery for control strategy 2 . 



Nose-up 

Nose-down 

Inverted 

Stall 

Deep Stall 

Spin 

High (3 

Structural loading: gi 

-0.74 

-0.86 

-0.58 

-0.79 

-0.70 

-0.66 

-0.87 

Roll rate: <72 

-0.93 

-0.98 

2.00 

-0.91 

-0.71 

-0.14 

-0.01 

Pitch rate: <73 

-0.51 

-0.68 

6.50 

-0.56 

-0.54 

0.37 

-0.41 

Yaw rate: < j ,\ 

-0.89 

-0.98 

5.66 

-0.81 

-0.16 

-0.16 

-0.25 

Angle of attack: g 5 

-0.24 

-0.22 

2.41 

-0.20 

0.06 

0.41 

-0.20 

Sideslip angle: g 6 

-0.94 

-0.99 

1.54 

-0.94 

-0.33 

-0.58 

-0.53 

Airspeed: <77 

0.04 

-0.23 

0.71 

-0.21 

0.19 

0.33 

0.05 

Altitude: g $ 

-0.24 

-0.52 

3.62 

-0.03 

0.43 

0.57 

0.70 

Translation: 779 

-0.06 

-0.30 

5.31 

-0.15 

2.26 

2.98 

1.96 

Rotation: 7710 

-0.99 

-0.99 

8.60 

-0.99 

-0.99 

-0.99 

-0.99 

Orientation: <711 

-0.67 

-0.69 

0.59 

-0.58 

-0.18 

-0.14 

-0.13 

Steady state: g 12 

-0.39 

-0.84 

36.50 

0.14 

1.44 

0.82 

1.43 

Pitch oscillations: (713 

-0.99 

-0.99 

196.7 

-0.99 

-0.95 

-0.86 

-0.96 

Roll oscillations: <714 

-0.99 

-0.99 

2.52 

-0.99 

-0.93 

-0.61 

-0.51 

Yaw oscillations: 7715 

-0.99 

-0.99 

893.4 

-0.99 

-0.96 

-0.89 

-0.82 


commands corresponding to the spin upset. The comparison with Figure 9 illustrates the 
difference made by the control law. Note that all inputs except the rudder saturate. 

B. Strategy 2: Global Analysis via SRFE Bounding 

The PSM and the CPV corresponding to strategy 2 are 35.9 and A" worst _ ca se = [—0.50, —6.45, 
86.5, 21.6, 10.8, 10.8, 14.63, —19.5] respectively. The critical requirement is the bounded mag- 
nitude of the steady state. Figure 13 shows the aircraft states and commands corresponding 
to this worst-case initial condition. As before, the steady-state requirement is violated at 
the terminal time of t = 45 s. This violation is caused by an unsettled pitch dynamics and 
a persistent loss in altitude. 


20 of 31 


American Institute of Aeronautics and Astronautics 


VI. Strategy 3: Controller C\ with a Feedback Command Law 

This control strategy pairs controller C\ with a state-varying command law. This law is 
given by Equations (21-24) and the feedback functions 


fa = ~hl, (28) 

U = (29) 

fv = 0, (30) 

f P = (h - 1 )r - /c 2 fc 3 |0|sign(0), (31) 


where k\ > 0; k 2 is equal to zero when \f>\ < 85 deg, it is equal to one when \f>\ > 90, and it 
is equal to |0|/5 — 13 otherwise; and k 3 > 0. The structure of a cmc j in (21) ensures that the 
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Figure 11. States corresponding to the spin upset for strategy 2. 


path angle is driven to zero in steady state, thus, a constant altitude is ultimately reached. 
The structure of f p yields a large roll rate when the absolute value of the bank angle exceeds 
90 degrees. This command will drive the vehicle to its Earth-down orientation. At this 
orientation, p cm d makes the yaw rate go to zero in steady state. While the functional form 
of f was inspired by the actions taken by a pilot in the real time simulation, the value of 
the constants h, h, and k 3 was set according to simulations. This simple command law is 
an oversimplification of the pilot commands used in engineering applications. However, for 
the scope of this paper, this command law proved to be effective. Better and more realistic 
command laws will be investigated in the future. 
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Figure 12. Control inputs corresponding to the spin upset for strategy 2. 


A. Strategy 3: Local Analysis via Point Simulations 

Table 3 shows the value of g corresponding to control strategy number 3 for each flight upset. 
In contrast to strategies 1 and 2, strategy 3 can recover the aircraft from all upsets. Note 
that the few requirements violated are not only soft but also take moderate values. Figures 
14 and 15 show the states, commands and control inputs corresponding to the spin upset. 
Note that in contrast to strategy 2, the commands are now time- varying. Further notice that 
both the aileron and throttle inputs saturate initially. The large disparity in the entries of 
Tables 2 and 3 indicate the high sensitivity of the recovery to the command law. 

B. Strategy 3: Global Analysis via SRFE Bounding 

The PSM and the CPV corresponding to strategy number 3 are 75.79 and X worst _ C ase = 
[—2, —13.7, 93.7, 45.6, —22.8, 22.8, —15.6, —41.0] respectively. The critical requirement is the 
bounded yaw rate. Figure 16 shows the aircraft states and commands corresponding to this 
worst-case initial condition. The requirement violation occurs at t = 0.18 s. Note than in 
spite of the soft violation, the command law makes all the states, directly and indirectly 
commanded, converge to the target values. 
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Figure 13. States and commands corresponding to the worst-case initial state for strategy 2. 
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Figure 14. States and commands corresponding to the spin upset for strategy 3. 


VII. Strategy 4: Controller C 2 with a Feedback Command Law 

This control strategy uses the gain scheduled controller C 2 and the same command law 
used in strategy 3. Recall that, as compared to C \ , this controller provided improved com- 
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Table 3. Figures of merit of upset recovery for control strategy 3. 



Nose-up 

Nose-down 

Inverted 

Stall 

Deep Stall 

Spin 

High 

Structural loading: gi 

-0.81 

-0.85 

-0.81 

- 0.86 

-0.73 

-0.70 

-0.91 

Roll rate: <72 

- 0.86 

-0.61 

-0.73 

-0.79 

-0.71 

-0.14 

- 0.01 

Pitch rate: g 3 

-0.59 

-0.50 

-0.27 

-0.64 

-0.47 

0.09 

-0.41 

Yaw rate: <74 

-0.90 

- 0.86 

-0.91 

-0.81 

-0.14 

-0.16 

-0.27 

Angle of attack: <75 

-0.25 

- 0.22 

-0.27 

-0.30 

-0.14 

-0.04 

-0.23 

Sideslip angle: g§ 

-0.94 

-0.92 

-0.93 

-0.93 

-0.33 

- 0.68 

-0.53 

Airspeed: <77 

0.04 

-0.36 

-0.57 

- 0.21 

-0.03 

-0.16 

-0.76 

Altitude: g s 

-0.70 

-0.67 

0.08 

-0.64 

- 0.21 

-0.24 

-0.32 

Translation: gg 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

Rotation: gio 

-0.99 

- 1.00 

-0.99 

-0.99 

- 1.00 

-0.99 

-0.99 

Orientation: gn 

-0.85 

-0.83 

-0.18 

-0.84 

-0.33 

-0.51 

-0.19 

Steady state: <712 

-0.99 

-0.99 

-0.98 

-0.99 

-0.98 

-0.98 

-0.98 

Pitch oscillations: <713 

-0.99 

-0.98 

-0.98 

-0.98 

-0.96 

-0.92 

-0.96 

Roll oscillations: <774 

-0.97 

-0.79 

-0.93 

-0.93 

- 0.88 

-0.87 

-0.62 

Yaw oscillations: <715 

-0.99 

-0.99 

-0.99 

-0.99 

-0.95 

-0.94 

-0.83 


mand tracking performance throughout the equilibrium manifold in Figure 2. 

A. Strategy 4: Local Analysis via Point Simulations 

Table 4 shows the value taken by the constraint functions for the flight upsets. As with 
strategy 3, strategy 4 was able to recover the aircraft from all upset conditions. Note that 
even though the values of g attained by both strategies are comparable, strategy 4 yielded 
responses that tended to have larger angular rates and more high-frequency pitch, roll and 
yaw oscillations. The tight command tracking attained by the controller near the equilibrium 
manifold degraded rapidly with the separation from the equilibrium condition. This can be 
seen in Figures 17 and 18 where the states, commands, and control inputs corresponding to 
the spin upset are shown. As before, a logarithmic scale for the time axis was used to better 
show the actions leading to the recovery. Note the large, high frequency oscillations in the 
three axes started occurring near t — 1 seconds. Since the command law is a function of the 
yaw rate, high-frequency oscillations in r yield high frequency oscillations in p. This will be 
the equivalent to pilot-induced oscillations (PIO). Undesirable oscillations may be the result 
of a faulty control law, a faulty command law, or a faulty interaction between them. These 
oscillations might occur at higher frequencies than conventional PIOs because the feedback 
laws prescribed by / yields commands varying as fast as the aircraft states. 

The precursor of this oscillations however, is the command law. The very same behavior 
was observed in piloted- real time-simulations under various flight conditions. 
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Figure 15. Control inputs corresponding to the spin upset for strategy 3. 



Figure 16. States and commands corresponding to the worst-case initial state for strategy 3. 


B. Strategy 4: Global Analysis via SRFE Bounding 


The PSM and the CPV corresponding to strategy number 4 are 51.52 and A worst _ case = 
[12.66,9.31,89.3,31.0,15.5,15.5,-9.0,27.9] respectively. As expected by the point simula- 
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Table 4. Figures of merit of upset recovery for control strategy 4. 



Nose-up 

Nose-down 

Inverted 

Stall 

Deep Stall 

Spin 

High P 

Structural loading: gi 

-0.77 

-0.85 

-0.81 

-0.85 

-0.74 

-0.70 

-0.90 

Roll rate: <72 

-0.90 

-0.61 

-0.64 

-0.90 

-0.73 

-0.15 

- 0.01 

Pitch rate: g 3 

-0.36 

-0.50 

-0.04 

-0.50 

-0.41 

0.55 

-0.41 

Yaw rate: <74 

-0.90 

- 0.88 

-0.34 

-0.81 

-0.19 

-0.16 

- 0.22 

Angle of attack: <75 

-0.25 

- 0.22 

-0.24 

-0.30 

-0.17 

-0.04 

-0.23 

Sideslip angle: g§ 

-0.93 

-0.92 

-0.81 

-0.89 

-0.33 

-0.79 

-0.53 

Airspeed: <77 

0.02 

-0.36 

-0.54 

- 0.21 

-0.03 

-0.16 

-0.78 

Altitude: g s 

-0.63 

-0.67 

0.02 

-0.65 

-0.34 

- 0.21 

-0.38 

Translation: gg 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

Rotation: gio 

-0.99 

- 1.00 

-0.99 

-0.99 

- 1.00 

-0.99 

-0.99 

Orientation: gn 

-0.75 

-0.83 

-0.18 

-0.79 

-0.39 

-0.44 

-0.18 

Steady state: <712 

-0.99 

-0.99 

-0.98 

-0.99 

-0.99 

-0.99 

-0.99 

Pitch oscillations: <713 

-0.96 

-0.98 

-0.33 

-0.98 

-0.91 

2.13 

-0.92 

Roll oscillations: <774 

-0.98 

-0.76 

-0.04 

-0.99 

-0.82 

-0.36 

-0.42 

Yaw oscillations: <715 

-0.99 

-0.99 

-0.45 

-0.99 

-0.95 

-0.76 

-0.74 
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Figure 17. States and commands corresponding to the spin upset for strategy 4. 
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Figure 18. Control inputs corresponding to the spin upset for strategy 4. 


tions, the critical requirement was the high frequency roll oscillation. Figure 19 shows the 
aircraft states and commands corresponding to this worst-case initial condition. The viola- 
tion occurred at the final time. During the maneuver, large and uncommanded oscillations 
in the rotational rates occurred. This oscillation, not the peak value of the states or the 
steady-state, was what prevented a larger expansion of the maximal set. 

VIII. Strategy 5: Controller C 3 with a Feedback Command Law 

This control strategy uses the gain scheduled controller C 3 and the same state-varying 
command law used above. Recall that, as compared to C 3 , this controller provides improved 
command tracking performance near the equilibrium manifold, but as compared to C 2 , this 
controller exhibited a less aggressive command tracking. 

A. Strategy 5: Local Analysis via Point Simulations 

Table 5 shows the value of g corresponding to each flight upset. There is less high-frequency 
oscillation than in strategy 4, and as much as in strategy 3. In some of the upsets, the 
performance of strategies 3 and 5 were practically the same since C 3 did mostly scheduled 
Ci throughout the manouver. Note, however, that the flight conditions going through stall 
made the constraint functions for roll and yaw rates take larger values. This is a consequence 
of the faster response of the lateral/directional controller. Figures 20 and 21 show the states, 
commands, and control inputs for the spin upset. As compared to C 2 , the high-frequency 
oscillations disappeared while the elevators and rudders are less active. 
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Figure 19. States and commands corresponding to the worst-case initial state for strategy 4. 



Figure 20. States and commands corresponding to the spin upset for strategy 5. 


B. Strategy 5: Global Analysis via SRFE Bounding 

The PSM and the CPV corresponding to this strategy are 75.82 and A worst _ case = [—2.0, —13.6, 
93.6, 45.4, —22.7, 22.7, —7.0, —40.9] respectively. As with strategy 3, the critical requirement 
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Table 5. Figures of merit of upset recovery for strategy 5. 



Nose-up 

Nose-down 

Inverted 

Stall 

Deep Stall 

Spin 

High /? 

Structural loading: gi 

-0.80 

-0.85 

-0.81 

- 0.86 

-0.73 

-0.70 

-0.91 

Roll rate: <72 

-0.85 

-0.61 

-0.73 

-0.83 

-0.56 

-0.14 

- 0.01 

Pitch rate: g 3 

-0.59 

-0.50 

-0.27 

-0.63 

-0.42 

0.06 

-0.41 

Yaw rate: <74 

-0.92 

-0.87 

-0.94 

-0.81 

0.11 

- 0.11 

-0.27 

Angle of attack: <75 

-0.26 

- 0.22 

-0.27 

-0.31 

-0.13 

-0.04 

-0.23 

Sideslip angle: g§ 

-0.94 

-0.92 

-0.95 

-0.93 

-0.33 

-0.56 

-0.53 

Airspeed: <77 

0.04 

-0.36 

-0.56 

- 0.21 

-0.03 

-0.16 

-0.77 

Altitude: g s 

-0.70 

-0.67 

0.08 

-0.64 

-0.28 

-0.24 

-0.33 

Translation: gg 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

-0.99 

Rotation: gio 

-0.99 

- 1.00 

-0.99 

-0.99 

-0.99 

- 1.00 

-0.99 

Orientation: gn 

-0.85 

-0.83 

-0.18 

-0.83 

-0.38 

-0.51 

- 0.20 

Steady state: <712 

-0.99 

-0.99 

-0.98 

-0.99 

-0.98 

-0.98 

-0.99 

Pitch oscillations: <713 

-0.99 

-0.98 

-0.98 

-0.98 

-0.97 

-0.92 

-0.96 

Roll oscillations: <774 

-0.96 

-0.78 

-0.94 

-0.94 

-0.83 

-0.76 

-0.62 

Yaw oscillations: <715 

-0.99 

-0.99 

-0.99 

-0.99 

-0.89 

-0.64 

-0.83 


was the bounded yaw rate. Figure 22 shows the states and commands corresponding to 
-^worst-case- There are slight differences in the worst-case condition and time responses of 
strategies 3 and 5. This is somewhat expected since the fixed-point controller C\ constitutes 
the gain scheduled controller C 3 , and the worst-case state occurs where controllers based on 
C\ are dominant. As before, the requirement violation occurs near t = 0.1 seconds. 

IX. Discussion 

The analyses above indicate that upset recovery strategies 3 and 5 are the most effective 
since they not only overcome the seven flight upsets but also attain the largest maximal 
sets (the PSMs of the five strategies are 42.1, 35.9, 75.79, 51.52 and 75.82 respectively). 
However, recall that C 3 , the controller used in strategy 5, provided a much better command 
tracking performance than C±, the controller used in strategy 3, at high angles of attack. 
This improvement, however, does not yield considerable advantages when A target is at the 
cruise condition. Note that other Atgets, e.g., stabilization at an angle of attack in the 
stall range, will render different assessments. The results coming out of the above analyses 
can be used to identify shortcomings of the control and command laws, as well as of the 
interaction between them, and to generate criteria for their tuning and redesign. Notice 
that the analysis above was able to identify command law-induced oscillations in C 4 . Ideally, 
the command law should be designed to complement the control law to avoid limit cycle 
oscillations resulting from unintended excitations. 
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Figure 21. Control inputs corresponding to the spin upset for strategy 5. 



Figure 22. States and commands corresponding to the worst-case initial state for strategy 5. 


X. Concluding Remarks 


This paper presents a framework for the systematic analysis of in-flight loss of control due 

to flight upsets. The framework carries out local and global analyses of recovery strategies 

30 of 31 


American Institute of Aeronautics and Astronautics 


that combine control and command laws based on high fidelity simulations of the aircraft 
response. Since the flight upsets occur well outside the nominal flight envelope, the devel- 
opment of accurate mathematical models at off-nominal flying conditions is of paramount 
importance. This framework enables a fair comparison of alternative upset recover strategies 
admitting arbitrary control structures and feedback-based command laws. While control laws 
are mostly set according to nominal flying conditions, command laws for upset recovery will 
only be used outside the normal flight envelope. They can be used to execute an automatic 
recovery or for pilot queuing. While equally effective command laws with various structures 
and functional forms can be designed and analysed, those that closely follow pilot’s actions 
will be preferred since they yield lower rotational rates. In the future, the authors will study 
pilot-generated commands during successful upset recoveries and determine if they can be 
well approximated by feedback-based structures. If this is the case, the above framework will 
enable quantifying the limits of the flight envelope from w a safe recovery is still possible. 
Furthermore, we will consider the design of command laws leading to large SRFEs following 
the same trends of those generated by a pilot. 
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